Memcached Monitoring

1
2
3
4
5

<dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-memcached-monitor</artifactId>
  <version>${cas.version}</version>
</dependency>

1

implementation "org.apereo.cas:cas-server-support-memcached-monitor:${project.'cas.version'}"

1
2
3
4
5
6
7
8
9

dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-memcached-monitor"
}

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.

  • cas.monitor.memcached.servers=localhost:11211

    • Comma-separated list of memcached servers.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
    The configuration settings listed below are tagged as Optional in the CAS configuration metadata. This flag indicates that the presence of the setting is not immediately necessary in the end-user CAS configuration, because a default value is assigned or the activation of the feature is not conditionally controlled by the setting value. You should only include this field in your configuration if you need to modify the default value.

  • cas.monitor.memcached.daemon=true

    • Set the daemon state of the IO thread (defaults to true).

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.failure-mode=Redistribute

    • Failure mode. Acceptable values are Redistribute,Retry,Cancel.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.hash-algorithm=FNV1_64_HASH

    • Hash algorithm. Acceptable values are NATIVE_HASH,CRC_HASH,FNV1_64_HASH,FNV1A_64_HASH,FNV1_32_HASH,FNV1A_32_HASH,KETAMA_HASH.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.kryo-auto-reset=false

    • If true, reset is called automatically after an entire object graph has been read or written. If false, reset must be called manually, which allows unregistered class names, references, and other information to span multiple object graphs.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.kryo-objects-by-reference=false

    • If true, each appearance of an object in the graph after the first is stored as an integer ordinal. When set to true, MapReferenceResolver is used. This enables references to the same object and cyclic graphs to be serialized, but typically adds overhead of one byte per object.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.kryo-registration-required=true

    • If true, an exception is thrown when an unregistered class is encountered.

    If false, when an unregistered class is encountered, its fully qualified class name will be serialized and the default serializer for the class used to serialize the object. Subsequent appearances of the class within the same object graph are serialized as an int id. Registered classes are serialized as an int id, avoiding the overhead of serializing the class name, but have the drawback of needing to know the classes to be serialized up front. See ComponentSerializationPlan for help here.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.locator-type=ARRAY_MOD

    • Locator mode. Acceptable values are ARRAY_MOD, CONSISTENT, VBUCKET.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.max-idle=8

    • Set the value for the maxTotal configuration attribute for pools created with this configuration instance.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.max-reconnect-delay=-1

    • Set the maximum reconnect delay.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.max-total=20

    • Sets the cap on the number of objects that can be allocated by the pool (checked out to clients, or idle awaiting checkout) at a given time. Use a negative value for no limit.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.min-idle=0

    • Get the value for the minIdle configuration attribute for pools created with this configuration instance.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.op-timeout=-1

    • Set the default operation timeout in milliseconds.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.protocol=TEXT

    • Protocol. Acceptable values are TEXT, BINARY.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.should-optimize=false

    • Set to false if the default operation optimization is not desirable.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.shutdown-timeout-seconds=-1

    • The number of seconds to wait for connections to finish before shutting down the client.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.timeout-exception-threshold=2

    • Set the maximum timeout exception threshold.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.transcoder=KRYO

    • Indicate the transcoder type. Available values are as follows:

    • KRYO: CAS transcoder implementation based on Kryo fast serialization framework suited for efficient serialization of tickets. Provides pooling mechanisms as well as control over object registration and sequences.
    • SERIAL: Kryp native transcoder that serializes and compresses objects.
    • WHALIN: Transcoder that provides compatibility with Greg Whalin's memcached client.
    • WHALINV1: Handles old whalin encoding: data type is in the first byte of the value.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.transcoder-compression-threshold=16384

    • For transcoders other than kryo, determines the compression threshold. Does not apply to kryo.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.
  • cas.monitor.memcached.use-nagle-algorithm=false

    • Set to true if you'd like to enable the Nagle algorithm.

    org.apereo.cas.configuration.model.core.monitor.MemcachedMonitorProperties.

    If you need to design your own password encoding scheme where the type is specified as a fully qualified Java class name, the structure of the class would be similar to the following:

    1
2
3
4
5
6
7
8
9
10
11

    package org.example.cas;

import org.springframework.security.crypto.codec.*;
import org.springframework.security.crypto.password.*;

public class MyEncoder extends AbstractPasswordEncoder {
    @Override
    protected byte[] encode(CharSequence rawPassword, byte[] salt) {
        return ...
    }
}

    If you need to design your own password encoding scheme where the type is specified as a path to a Groovy script, the structure of the script would be similar to the following:

    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

    import java.util.*

byte[] run(final Object... args) {
    def rawPassword = args[0]
    def generatedSalt = args[1]
    def logger = args[2]
    def casApplicationContext = args[3]

    logger.debug("Encoding password...")
    return ...
}

Boolean matches(final Object... args) {
    def rawPassword = args[0]
    def encodedPassword = args[1]
    def logger = args[2]
    def casApplicationContext = args[3]

   logger.debug("Does match or not ?");
   return ...

    Password Policy Strategies

    If the password policy strategy is to be handed off to a Groovy script, the outline of the script may be as follows:

    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

    import java.util.*
import org.ldaptive.auth.*
import org.apereo.cas.*
import org.apereo.cas.authentication.*
import org.apereo.cas.authentication.support.*

List<MessageDescriptor> run(final Object... args) {
    def response = args[0]
    def configuration = args[1];
    def logger = args[2]
    def applicationContext = args[3]

    logger.info("Handling password policy [{}] via ${configuration.getAccountStateHandler()}", response)

    def accountStateHandler = configuration.getAccountStateHandler()
    return accountStateHandler.handle(response, configuration)
}

    The parameters passed are as follows:

    Parameter Description
    response The LDAP authentication response of type org.ldaptive.auth.AuthenticationResponse
    configuration The LDAP password policy configuration carrying the account state handler defined.
    logger The object responsible for issuing log messages such as logger.info(...).

    Authentication handlers that generally deal with username-password credentials can be configured to transform the user id prior to executing the authentication sequence. Each authentication strategy in CAS provides settings to properly transform the principal. Refer to the relevant settings for the authentication strategy at hand to learn more.

    Authentication handlers as part of principal transformation may also be provided a path to a Groovy script to transform the provided username. The outline of the script may take on the following form:

    1
2
3
4
5

    String run(final Object... args) {
    def providedUsername = args[0]
    def logger = args[1]
    return providedUsername.concat("SomethingElse")
}

    Configuration Metadata

    The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.

    Be Selective

    This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.

    YAGNI

    Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.

    Naming Convention

    Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc.

    When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value. The only possible exception to this rule is when naming actuator endpoints; The name of the actuator endpoints (i.e. ssoSessions) MUST remain in camelCase mode.

    Settings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.

    Validation

    Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. The validation process is on by default and can be skipped on startup using a special system property SKIP_CONFIG_VALIDATION that should be set to true. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.

    Indexed Settings

    CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.

    The actual memcached implementation may be supported via one of the following options, expected to be defined in the overlay.

    Reports back general health status of the system, produced by various monitors.

    HealthComponent

    HealthEndpoint.healthForPath(java.lang.String…)
    org.springframework.boot.actuate.health.HealthEndpoint

    Reports back general health status of the system, produced by various monitors.

    HealthComponent

    HealthEndpoint.health()
    org.springframework.boot.actuate.health.HealthEndpoint


    Spymemcached

    Enable support via the spymemcached library.

    Support is enabled by including the following dependency in the WAR overlay:

    1
2
3
4
5

    <dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-memcached-spy</artifactId>
  <version>${cas.version}</version>
</dependency>

    1

    implementation "org.apereo.cas:cas-server-support-memcached-spy:${project.'cas.version'}"

    1
2
3
4
5
6
7
8
9

    dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-memcached-spy"
}

    AWS ElastiCache

    For clusters running the Memcached engine, ElastiCache supports Auto Discovery—the ability for client programs to automatically identify all of the nodes in a cache cluster, and to initiate and maintain connections to all of these nodes.

    Support is enabled by including the following dependency in the WAR overlay:

    1
2
3
4
5

    <dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-memcached-aws-elasticache</artifactId>
  <version>${cas.version}</version>
</dependency>

    1

    implementation "org.apereo.cas:cas-server-support-memcached-aws-elasticache:${project.'cas.version'}"

    1
2
3
4
5
6
7
8
9

    dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-memcached-aws-elasticache"
}